CISA Says Attackers Are Using the Brotli Bug OpenAI’s Bug Hunters Found

CISA says attackers are now exploiting CVE-2026-111497, a bug in Brotli, the compression code built into Node.js: it added the bug to its Known Exploited Vulnerabilities catalog on October 27, 2026, and gave federal agencies until November 10 to fix it. The Node.js project credits Khai Tran and Sylvie Mayer of OpenAI Codex Security for reporting it. ELLIO says its sensors recorded exploit traffic in the wild, including one Brotli request body of 23,069,983 bytes, and that a malformed compressed request returns a shell on an official, unmodified Node.js build. The Hacker News (Oct 28) says it is not yet known how broad these attacks are.